resolved: deal with unsigned DS/NSEC/NSEC3 properly
authorLennart Poettering <lennart@poettering.net>
Thu, 24 Dec 2015 13:08:22 +0000 (14:08 +0100)
committerLennart Poettering <lennart@poettering.net>
Sat, 26 Dec 2015 18:09:10 +0000 (19:09 +0100)
commitb63fca62453969f816c687ac4cf438d5cefa4552
tree1e04c756a258560226ddaca585d4e103783d61b4
parentf61dfddbff4c826bfcbca7b413674770546fa527
resolved: deal with unsigned DS/NSEC/NSEC3 properly

Previously, we'd insist on an RRSIG for all DS/NSEC/NSEC3 RRs. With this
change we don't do that anymore, but also allow unsigned DS/NSEC/NSEC3
if we can prove that the zone they are located in is unsigned.
src/resolve/resolved-dns-transaction.c